CMS proposes electronic prior authorization rules for drugs in Medicare, Medicaid and exchanges

CMS published a proposed rule on April 14, 2026 that would extend electronic prior authorization requirements to prescription drugs in Medicare Advantage, Medicaid, the Children's Health Insurance Program and plans sold on the Federally-facilitated Exchanges ^[1][2]. The proposal, docket number CMS-0062-P, runs 173 pages in the Federal Register ^[1]. If finalized as written, payers would have until October 1, 2027 to bring drugs into their electronic prior authorization systems ^[2].

The proposal builds on a 2024 final rule that required those same payers to run electronic prior authorization for non-drug items and services ^[2]. For drugs covered under a medical benefit, CMS proposes requiring payers to add coverage and documentation requirements to their existing Prior Authorization API beginning October 1, 2027 ^[2]. For drugs covered under a pharmacy benefit, CMS proposes requiring state Medicaid fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and exchange plan issuers to support three National Council for Prescription Drug Programs standards — SCRIPT, Formulary & Benefit, and Real-Time Prescription Benefit — also beginning October 1, 2027 ^[2]. CMS says those standards let providers check formulary information, see real-time coverage details, and exchange prior authorization requests and decisions electronically ^[2]. The agency describes the pharmacy-benefit proposal as aligning with requirements that already apply to Medicare Part D sponsors ^[2].

The rule also proposes decision deadlines. State Medicaid fee-for-service programs, Medicaid managed care plans and CHIP managed care entities would have to decide prior authorization requests for all drugs within a timeframe aligned with existing rules for covered outpatient drugs — no later than 24 hours after receiving a request — or within the items-and-services timeframes of seven days for standard requests and 72 hours for expedited ones ^[2]. State CHIP fee-for-service programs would face a 24-hour notice requirement ^[2].

Separately, the Department of Health and Human Services proposes adopting the HL7 FHIR standard and related implementation guides for prior authorization transactions under HIPAA, including the Da Vinci Clinical Data Exchange guide for supporting documents such as PDFs and text files ^[2]. HIPAA-covered entities that conduct these electronic transactions would have 24 months after a final rule's effective date to comply, and small health plans would have 36 months ^[2].

CMS also wants payers to report their API endpoints and technical documentation so the agency can publish them in one place. Existing payers would report within 60 days of a final rule's effective date; new payers would report 60 days before they begin covering patients, then update the information within one week of any change and verify it at least annually ^[2]. CMS proposes adding small group market issuers on the Federally-facilitated Small Business Health Options Program as payers covered by the requirements ^[2].

Why it matters for patients

Prior authorization is often the step between a prescription and a filled prescription, and it is one of the most common complaints about GLP-1 coverage. Under this proposal, requests for drugs in Medicaid, CHIP, Medicare Advantage and exchange plans would move through standardized electronic channels, with 24-hour decision windows in Medicaid and CHIP ^[2].

The rule would not change which drugs are covered, what clinical criteria payers use, or what patients pay. Neither the proposed rule nor the CMS fact sheet names GLP-1 medications such as Ozempic, Wegovy or Zepbound, or any specific drug or drug class ^[1][2]. Whether electronic prior authorization shortens real-world waits for patients has not been reported. The requirements would apply to specific payer types and would not reach employer self-funded plans or most commercial coverage outside the exchanges. Medicare Part D sponsors already operate under comparable electronic prior authorization requirements, and the proposal does not add new ones for them ^[2]. Nothing changes for patients while the rule remains a proposal.

What happens next

The comment period closed June 15, 2026 ^[1]. CMS has not announced a date for a final rule, and it is not yet known whether the agency will finalize the proposal as written or change the deadlines. If finalized as proposed, the drug prior authorization requirements would begin October 1, 2027 ^[2]. The Office of the National Coordinator for Health Information Technology separately proposes that certain currently adopted versions of standards expire on January 1, 2028 ^[2].